{"slug": "show-hn-attentry-a-local-checker-that-reviews-each-edit-claude-code-makes", "title": "Show HN: Attentry – a local checker that reviews each edit Claude Code makes", "summary": "Attentry, a preview-stage local checker distributed as a VS Code and Open VSX extension, reviews each edit Claude Code makes and reports newly introduced security holes, crash risks, copied functions and dead code back to Claude so it can fix them immediately. Attentry reads JavaScript, TypeScript (including JSX and TSX), Python and Astro, runs in a suggestion-only mode by default and offers a block mode that refuses exact copies and prevents a task from finishing while it has added a security or crash problem. The tool also exposes four read-only MCP SDK-based tools — `find_existing`, `check`, `explain` and `check_plan` — and runs the repo's test command in the background every 10 edits, stopping a run after 300 seconds unless `testTimeoutSeconds` is changed.", "body_md": "Attentry checks the code your AI agent writes. It works with Claude Code: after each edit, it tells Claude about any security hole, crash risk, copied function or dead code that the edit added, so Claude can fix it straight away. When the task is done, you get a short summary of what changed.\n\nWebsite: [attentry.js.org](https://attentry.js.org)\n\nAttentry is in preview. It reads JavaScript, TypeScript (including JSX and TSX), Python and Astro.\n\nInstall the extension from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=attentry.attentry), or from\n[Open VSX](https://open-vsx.org/extension/attentry/attentry) if you use Cursor, Windsurf or another VS Code fork. Then open the Attentry panel in the sidebar and click **Connect Claude\nCode**. That's all the setup there is. It adds Attentry to Claude Code for every project, and the\nextension keeps it up to date.\n\nAttentry speaks up at a few moments during a Claude Code session, and stays quiet the rest of the time. A clean edit gets no message at all.\n\n- When a session starts, Claude gets one line saying Attentry is on.\n- When you send a request, Claude is told about code in the repo that matches it, for example\n\"the repo already has `timeAgo` in src/utils/time.js\". That way it builds on what exists.\n- When Claude finishes a plan, Attentry reads it and points out anything the repo already has: a\nhelper the plan would write again, a route that already exists, a file that changes all the time,\nor a plan too big to do in one go. You can also ask for this check by typing `/attentry:plan` .\n- Before an edit, if Claude is about to write a function the repo already has, it's told where the existing one is and how often it's used.\n- After an edit, Claude hears about the problems that edit added, each one once. Problems that were in the repo before the task started are left out.\n- Every 10 edits there's a short check-in, and your tests run in the background.\n- At the end of the task you get a change card: the files Claude changed, the problems it added or fixed, and whether the tests passed.\n\nBy default Attentry only makes suggestions. In block mode it also refuses exact copies, and won't let a task finish while it has added a security or crash problem. Switch modes in the panel.\n\nAttentry looks for your test command (`npm test`, `pnpm test`, pytest and so on, in each app of\nthe repo). You can set your own in `.attentry/config.json` with `\"tests\": \"make check\"`, or turn\ntests off with `\"tests\": \"off\"`. A run is stopped after 300 seconds unless you change\n`\"testTimeoutSeconds\"`.\n\nBecause a test command can run anything, Attentry only runs commands you've allowed. Connecting\nClaude Code allows the current ones, and Attentry asks again if they change. `attentry doctor`\nshows what's allowed.\n\nBesides speaking up on its own, Attentry gives Claude four tools it can call when it wants to:\n\n- `find_existing` looks for a function that already does a job, from a short description or from\nthe code Claude is about to write.\n- `check` lists the problems in Claude's changes, or in the files it names, and marks the ones this\ntask added.\n- `explain` gives the full story of the findings on one line: what the code does, why it matters,\nhow to fix it and how to check the fix.\n- `check_plan` runs the plan check on demand.\n\nAll four only read. They're built on the official MCP SDK and validate every call, so a bad call comes back as an error Claude can read and correct.\n\n**Security.** Routes with no login check, admin routes that don't check the role, records loaded\nby id without checking who owns them, and logins with no rate limit. The same checks cover\nSocket.io events, WebSocket messages, tRPC procedures, GraphQL resolvers and Next.js server\nactions. In the code itself it looks for SQL, NoSQL and command injection, `eval`, SSRF, open\nredirects, unsafe file paths, mass assignment, secrets written in the code, `.env` files in the\nrepo, XSS, CORS with credentials, leaked stack traces, weak password hashing, unverified JWTs and\n`Math.random()` tokens. If your project uses a backend Attentry can't read yet (hapi or Elysia,\nfor example), it says so instead of reporting \"no issues\".\n\n**Crash risks.** Async Express 4 handlers with no error handling, `JSON.parse` on data from\noutside, and handlers that exit the process.\n\n**Frontend and backend.** Calls to API routes that don't exist (with the route you probably\nmeant), calls with the wrong HTTP method, and routes nothing calls any more. It understands\nExpress, Koa, Hono, Fastify, NestJS, Next.js, FastAPI, Flask and Django on the backend, and fetch,\naxios, apisauce, superagent, generated clients and Vite's proxy on the frontend.\n\n**Database.** Money stored as floats, queries inside loops, trees fetched one level at a time, and\nINSERTs without column names. It also flags `SELECT *`, `ORDER BY RAND()` and `LIKE '%x%'` as\nhints. It works with Mongoose, Sequelize, TypeORM, Prisma, Knex, Django, SQLAlchemy, SQLModel and\nraw SQL.\n\n**Copies and dead code.** Exact and near copies of functions (showing what differs), including the\nsame logic written in both JavaScript and Python. Unused packages (with their size), unused files,\nand functions nothing calls.\n\n**Hotspots.** Complex files that change often, worked out from the git history, so you know where\na change is most likely to break something. This needs a git clone, not a downloaded zip.\n\n**Code hygiene.** Errors that are ignored or only logged, commented-out code, comments that just\nrepeat the code, unused parameters and deep nesting.\n\nTo silence a finding, add a comment with a reason on its line or the line above:\n`// attentry-ignore empty-catch: the cache is optional` (use `#` in Python). A comment without a\nreason doesn't count.\n\nThe extension underlines problems in your changes, or in the whole repo if you click the status bar. Hover over one to see what the code does, what can go wrong, and how to fix it. These explanations come from the code itself, so they don't use any AI credits.\n\nSecurity and crash problems show as errors, things that will break as warnings, and clean-up as info. The light bulb can delete unused code (the only automatic fix), copy the fix so you can paste it to your agent, or ignore the finding with a reason. If you mark more than 10% of a rule's findings as not useful, that rule drops to a hint.\n\nThe Attentry panel shows what's wrong by category, whether Claude Code is connected, how its current task is going, and when the repo was last checked.\n\nThe extension works in VS Code, Cursor, Windsurf and Antigravity. Other editors, such as JetBrains,\nZed and Neovim, can run `attentry lsp` as a language server.\n\nYou need Node 22 or newer. From a clone of this repo:\n\n```\nnpm install\nnpm run attentry -- scan path/to/your/repo\n```\n\nUseful options:\n\n- `--changed` shows only what your branch or uncommitted work added.\n- `--brief` prints at most ten lines, one per error or warning. This is the short version an agent\nneeds.\n- `--all` includes hints, the findings Attentry is less sure about.\n- `--agent` prints each finding as steps an agent can follow.\n- `--markdown` writes a report for a Markdown preview or a pull request comment. Add`--out attentry-report.md` to save it.\n- `--json` prints the findings as JSON.\n\n`attentry explain src/app.ts:42` explains the findings on one line, and `attentry doctor` checks\nthat Attentry is set up correctly and tells you how to fix anything that isn't.\n\nTo use Attentry with Claude Code without the extension, build it and set up the hooks in a repo:\n\n```\nnpm run build\nnode dist/attentry.mjs init path/to/your/repo\n```\n\nAttentry runs on your machine and only reads your repo. Your code never leaves it.\n\nA background process keeps the repo in memory, never on disk, so a check after an edit only rereads what changed. That takes about 0.1 seconds on a 150-file repo and about 2 seconds on a 2,000-file one. The first read takes roughly 10 seconds per 1,000 files, and Claude doesn't wait for it: edits made in the meantime are checked once it's done. The process stops after half an hour without use.\n\nThe hooks, the tools and the editor all talk to the same process, so they always agree. If two\nagents work in the same repo, each one only hears about its own edits. Every answer is signed with\na key stored in `~/.attentry` that only you can read, so nothing else can pretend to be Attentry.\n\n- [SPEC.md](https://github.com/Aarv-1o/Attentry/blob/main/SPEC.md) : what version 1 will do\n- [AGENTS.md](https://github.com/Aarv-1o/Attentry/blob/main/AGENTS.md) : rules for anyone, person or agent, working on this repo\n- [docs/research.md](https://github.com/Aarv-1o/Attentry/blob/main/docs/research.md) : the research behind the decisions\n- [docs/TESTING.md](https://github.com/Aarv-1o/Attentry/blob/main/docs/TESTING.md) : how to test Attentry by hand\n\nAttentry is open source under the MIT licence. Made by [Aarv Singh Chauhan](https://aarv.is-a.dev/).", "url": "https://wpnews.pro/news/show-hn-attentry-a-local-checker-that-reviews-each-edit-claude-code-makes", "canonical_source": "https://github.com/Aarv-1o/Attentry", "published_at": "2026-11-09 19:04:39+00:00", "updated_at": "2026-11-09 19:23:59.364109+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety", "agent-protocols"], "entities": ["Attentry", "Claude Code", "Anthropic", "VS Code Marketplace", "Open VSX", "Cursor", "Windsurf", "MCP SDK"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-attentry-a-local-checker-that-reviews-each-edit-claude-code-makes", "markdown": "https://wpnews.pro/news/show-hn-attentry-a-local-checker-that-reviews-each-edit-claude-code-makes.md", "text": "https://wpnews.pro/news/show-hn-attentry-a-local-checker-that-reviews-each-edit-claude-code-makes.txt", "jsonld": "https://wpnews.pro/news/show-hn-attentry-a-local-checker-that-reviews-each-edit-claude-code-makes.jsonld"}}